Andrey Litvitski

**Name of the Vulnerable Software and Affected Versions** Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0 through 5.7.25 **Description** Several components use standard string equality via the `String.equals()` function to compare security-sensitive values instead of using a constant-time comparison. This allows the time taken to reject an incorrect value to be proportional to the number of leading characters that match the expected value, potentially enabling timing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.